Security control of automatic elevator cars



June 11, 1968 J. E. MAGEE 3,388,376

SECURITY CONTROL OF AUTOMATIC ELEVATOR CARS Filed April 26, 1965 2Sheets-Sheet vl RESET ca SCOI CKSa T13' la RIVT IUC lawns R186 seq ai nuE 1NVENTOR.

JOHN /VAGEE @m MyW.

47' UPA/EVS June 1l, 1968 .1. E. MAGEE 3,388,375

SECURITY CONTROL OF AUTOMATIC ELEVATOR CARS UPH@ l scan VB3@ cm SET X531SCXQ D D s;

Resa-r scm@` sexs NORMAL d D JTW OPEN coNTRoL NORMAL 'NORMAL ca osecLose CONTROL l CONTROL4 NRMAL SCX4Q SCXSn OPEN {j} G CONTROL y fia.

CBUG. 5CX70. UPBo.

Ta 6%@ my@ 4r oen/.sys

United States Patent O 3,388,376 SECURITY CONTRUL F AUTOMATEC ELEVATORCARS John E. Magee, Greeuburgh, NSY. (191 Forest Blvd., Ardsley, NSY.H1502) Filed Apr.. 26, 1965, Ser. No. 450,793 13 Claims. (Cl. 346-20)ABSTRACT 0F THE DlSCLSURE This invention relates to control systems forone or more elevators and particularly to control sys-tems forpreventing unauthorized travel of automatic elevator cars to a landingor landings.

At -the present time, in buildings serviced by elevators withoutattendants, non-supervised access to upper dloors of the building isprovided by elevators for unauthorized persons, as well as forlegitimate passengers, such aS tenants. This may be particularlyundesirable during late evening or early morning hours in either otiiceor apartment type structures. During such periods, stairwell access -toupper floors may be prevented by `suitable lire door arrangements. Also,service Idemands may be anticipated to be intermittent at such times,with parked elevators normally stationed at the lobby, or buildingentrance landing.

4It is an object of this invention to provide a control system forelevator cars which will restrict their use from a specific landing toauthorized persons and detect their attempted use by -those who areunauthorized.

kIt is a further object 0f the invention t-o afford normal response ofthe elevators to or from demandsfat all other landings of the structure.

It is another object of the invention to provide a deterrent and alarmsystem to discourage attempted use of the elevators by any unauthorizedpersonnel.

The preferred embodiment of the invention predicates dispatch ordeparture of an occupied elevator car from the building entrance landingon registration of demand in the car by means of a set of security callbuttons. A demand is registered by utilizing an appropriate combinationof suc'h buttons for a particular oor, such combination being preferablydisassociated numerical-ly from the landing location number servedtherefrom so as to constitute a coded or combination arrangement of carcall registration. The departure of an unoccupied car loccurs in anormal manner for response to landing calls at other landings. Return oflone or more cars to the building entrance landing is also provided.

The bank of security call buttons in each car is arranged such that useof one or more of certain buttons therein, not required for the securitycall registration, will actuate an audible or visual alarm, which may beremotely located for central station surveillance.

As an alternate arrangement for installation without means for occupancydetection the security buttons are supplemented by an arrangement forforced travel from the lobby t-o a registered hall call in the eventthat a `security car call is not in registration. This insures thatPatented June ll, 1968 ICC an unregistered passenger in that car, -thatis, a passenger who has not registered a call, will be delivered t-o thetloor of the hall call, subject to surveillance. In addition, the dooroperating mechanism is controlled to retain closing force sufficient toprevent their being opened manually during such restricted travel.

Features and advantages of this invention will be apparent from theforegoing and from the following description of the preferred.embodiment thereof which should be considered in conjunction with theaccompanying drawings in which:

FIGS. 1 and 2 are simplified, schematic wiring diagrams showing themodiication of the control circuits shown and described in my co-pendingapplication Ser. No. 209,564, filed July 13, 1962, and entitled,Segregated Demand Controls for Elevator Systems, required to adapt suchcircuits to the use of the present invention;

EFIG. 3 is a simplified, schematic wiring diagram of control initiatingand car responsive circuits used with the invention;

FIGS. 4 and 45 are simplified, schematic wiring diagrams of portions ofthe security button arrangements for a single car; and

FIGS. 6 and 7 are simpliiied, schematic wiring diagrams of analternative embodiment of 4the invention, shown for one car.

The invention will be described, for convenience, as a control systemfor a three car group of elevators. For simplification in descriptionand illustration it will be described as applied in conjunction with thecontrol system shown and described in my co-pending patent applicationSer. No. 209,564, filed July 13, 1962 and entitled, Segregated DemandControl for Elevator Systems (hereinafter called the reference system),utilizing the same diagram conventions as outlined therein. Circuitsshown herein designated FIGS. 1 and 2 will be seen to be portions of`FIGURES l and 2 of said application, each as modified by thisinvention. FIGS. 3, 4 and 5 herein constitute circuitry of the preferredembodiment which is in addition to the circuits shown and described insaid application. `In certain of the drawings additional contacts ofswitches of the reference system are used, and in each case the switchidentifying letters of the reference system are used in the presentdrawings with a new higher contact number applied as a suiX. To furtherclarify new components of the preferred embodiment, each such newcomponent is identified by the pre- X letters SC, except for thesecurity buttons which are identified by the preiix SB. To simplify thedisclosure, all circuits other than those of FIGURES l, 2 and 3 areshown for car a only, it being understood similar circuitry for cars band c will apply the invention to those cars.

Actuation of the switch SCKS (FIG. 3) initiates the control system ofthe invention. Switch SCKS may be by key, or clock, actuated, such as atthe time of termination for the night of direct building supervision.Its closing energizes group switch SC. Contacts SCI closed thereby, thruML3 contacts, closed in conjunction with each associated cars locationat the lobby, permit operation of the specific SCC switches andillumination of the parallel SCL indicators to signal use of thesecurity car button system for service from the lobby.

Opening of contacts SC2 (FIG. 1) and SC3 and SCF', (FIG. 2)respectively, causes isolation of certain controls of the referencesystem. Contacts SC3 opening erase dispatch timing control of lobbydepartures on the presumption that traffic is intermittent. Contacts SC2opening prevent dispatch control by a lobby landing call. Contacts SC4opening void operation in the reference system which is predicated on anumber of up landing calls, such calls not being anticipated inconjunction with periods of application of this invention.

assasrs Contacts SCCla (FIG. 1) `opening isolate dispatch control by alobby car call through intermediate action of CKa switch. It is to beunderstood that similar SCClb and SCClc contacts (not shown) exercise asimilar prevention of control for cars b and c, respectively, whenpositioned at the lobby landing.

Contacts SCC2a (FIG. 1) closing and contacts SCCSa (FIG. 2) opening,respectively, render control of car starting from the lobby dependent onbeing unoccupied because of the SCO contacts, or if occupied, dependenton the registration of a recognized demand in the car, by way of CKcontacts. This recognized demand will be shown later to involveappropriate use of security call buttons in the respective car.

Mechanically actuated contacts SCOIa (FIG. 1) and SCOZa (FIG. 2) areactuated in a conventional way to detect occupancy of the car, such asby responsive movement or deflection of the car platform in a mannercommonly applied in the art. Presence of a passenger closes SCOlacontacts and opens SCOZa contacts. In the absence of a registeredrecognized demand in the car, contacts CKSa (FIG. l) remain closed andcontacts CKda (FIG. 2) of the CK switch remain open. Setting of switchSRa is thus restricted by circuits of FIG. 2, and its reset status issustained in FIG. 1 circuits thru closed SCCZa, SCOIa and CKSa contacts.Registration of a recognized call will be seen later, to actuatereference switch CKa, opening its CKSa contacts to isolate SRa resetwinding and closing its contacts CK6a to permit setting SRa for carstarting subject to closed status of WBXZa contacts and NTI@ contacts(FIG. 2). In the absence or an occupant in the car, open SCOIa contactsisolate the reset circuit of FIG. 1, and closed SCOZa contacts of FIG. 2permits dispatch of the car independent o-f status of Clint contacts.This permits the unoccupied car to start up from the lobby to respond tolanding calls at upper oors.

Open SCC-'ta contacts (FIG. 1) can be seen to render all upper doorconventional car call registration contacts ineffective. Sustainingeiect of car call switch self-holding contacts I2C2a thru TCZa, however,is not affected. Security button ISBIfz (FIG. 1) is connected inparallel with the conventional lCBa button contact to permitenergization of circuit connection mC. This connects to the same circuitdesignation mC of FIG. 4.

FIG. 4 includes circuitry for the security car call registrationarrangement of the invention. With contacts SCCSa closed, the circuit isprepared for actuation of each car call switch in car a in response toactuation of an appropriate sequence of three security buttons. Asstated, lead mC of FIG. 4 connects to lead mC of FIG. 1. Also, any eightof the points, ma through mj of FIG. 4 are cross connected to the eightpoints m12 thru mT of FIG. 1 in any predetermined desired arrangement.For example, assume it is elected to connect me to m18 and mf to m12.Recognition of a lobby passengers demand for service to the eighteenthlanding would necessitate operation of button 1SB1a of FIG. 1 followedby actuation of security buttons 13SB1a and ISSBIU, i.e., 1-13-16. Forservice to the twelfth landing ISBla followed by 17SB1a and 18SB23 wouldbe required, i.e., 1-17-18. For example, the circuit for the eighteentho'or arrangement would be from the positive power feed through lSBla,sustained by then operated IClla, through connections mC, thru closedSCCSa contacts, through operated security button contacts 13SB1a andIGSSBIa, from the me connection to the m18 connection and throughresistor RISCa to actuate switch 18Ca of the reference system. Switch18Ca is then sustained through its 18C2a contacts. Contacts 18C1aclosing in FIGURE 1 of the reference system can be seen to result inactuation of switch CKa. Contacts CKSa and CK6a, as described above,permit car starting and SRa setting, independent of occupancy detectingof SCOIa and SCOZa contacts.

It may be seen that the full complement of security buttons, 128Bthrough TSB, is not required for call regl istration. For the electedarrangement buttons 148B are thus excluded. In FIG. 5 through closedSCCoa contacts, buttons 14Sl3la and TSBla or either of them, whenactuated, cause energization of alarm SCBa. Alarm SCBa may be audible orvisual and preferably would be located remotely such as in asuperintendents quarters or a security service central station.

It is obvious that other arrangements of buttons may be used, bytransposition. Specific applications of buttons ISBIQ, ISSBIa, l'SEa orIll-SBM and TSBla may be interchanged with others of the group. Also,instead of a separate set of security buttons (SB buttons), chosen forsimplification of the disclosure, the contacts thereof may be added toand operated by the conventional car buttons IZCBa through TCBa. Extracontact buttons also can permit an expanded number of combinationsavaiiable, if desired. It will also be apparent to those skilled in theart that magnetically held buttons which are old in the art can permitsequential button operation.

For installation in which the occupancy detection conftrol of SCOcontacts is found inconvenient these contacts and their associated SCCand CK contacts of FIGS. 1 and 2 may be omitted. As an alternatearrangement circuits of FIGS. 6 and 7 would then be utilized. ContactsMLS would be arranged to remain closed until after their associated BVBabrushes, of FIG. 2 of the reference system, separated from their MVBcontacts upon departure of cars from the lobby. Without a recognized carcall demand contacts CK7a of FIG. 6 would be closed. In such case, car ain traveling up, contacts UPlla closed, from the lobby would permitcontacts VBBa to close 'before contacts SCC7a opened, to thusset SCXaswitch. Switch SCXa would remain set until car a approached its firstlanding call stop at which time contacts XSBa, of the reference systemXS switch, close to complete a circuit through closed SCXIa contacts forreset of SCXa. During this period of car travel contacts SCXZa and SCXSasustain closing excitation of door motor armature DMAa and contact SCXastrengthen the door motor eld excitation to aiford sumcient torque t-oprevent manual opening of doors by an occupant. During the sametravelperiod, open contacts SCXa of FIG. 1 prevent stopping in response to anynon-security car call. Surveillance by the entering landing passenger isthus afforded at the upper landing stop.

To facilitate an understanding of operation of the invention as appliedto a group of elevators, assume cars a, b and c of the reference systemare arranged for response according to the invention herein disclosedand that all are parked at the lobby building entrance level designatedas the first landing. With security control switch SCKS assumed closed,switches SCCa, SCCb and SCCc will be actuated. Assume car a is the carselected as next lto leave, with WBa switch of the reference systemenergized, and a person enters that car who is unfamiliar with use ofthe security button arrangement. Such occupancy actuates contacts SCOIato closed status and SCOZa to their open condition. Assume then that alanding call at an upper landing is registered. In :the reference systemswitch UDB will then be seen to operate followed by switch SI, the SIZcontacts of which interrupt excitation of switch T coil. With SC3contacts, FIG. 2 separated, switch T drops without the capacitive delayof condenser CIT. Contacts T1 closing energize switch WBXa through WBSacontacts. Contacts WBX2a close without effect since open SCC3a and openSCOZa contacts of FIG. 2 render that circuit inoperative at this time,with CK6a contacts also separated. If landing call response had beeninitiated to set SRa prior to entrance of the lobby passenger, closingof SCOIa contacts, FIG. 1 would result in reset of SRa through closedSCCZa and CKSa contacts.

'Upon operation of WBXa, reference system FIG. 2, its WBX3a contactsseparate to release switch WBa. Contacts WB3a and WBta then close topermit selection of another car. Assume this is car b in which event WBboperates.

sassari@ At this same time open WBXla contacts cause release of switchSI which closes `contacts SI2 permitting reenergization of switch T,thus opening contacts T1. This defers operation of switch WBXb althoughWBSb contacts are closed.

After a ybrief period the retentive charge of capacitor CWBa isdissipated to permit release of WBXa switch. Its normally closedcontacts WBXla close to complete a circuit thru still closed UDBIcontacts to operate switch SI again, in turn again releasing T switch.Contacts T1 'closing now c-omplete a circuit thru closed WBSb contactsto operate WBXb switch. Contacts WBXZb closing, in conjunction withclosed SCO'Zb contacts, in the circuit for that car similar to that ofcar a in FIG. 2, permit dispatch of the unoccupied car b to service theassumed upper 'landing call.

It is thus seen that a lobby passenger entering car a who is notfamiliar with the security button combination method of registeringdemand is excluded from service to upper floors even if a concurrentlanding demand exists above. The occupied car loses selected `status anda next selected car responds to the landing call, presuming such secondcar is unoccupied. It is also apparent that if car a were not occupiedits closed SCOZa contacts would have permitted its dispatch for responseto the assumed upper landing call when contacts WBXZa, FIG. 2, closed.

it is readily seen in FIG. 1 that with SCC4a contacts open, use of theconventional button contacts will be ineifective. Also from FIG. 4 itcan be seen that use of a single security button associated by numberwith -a desired destination will likewise be ineffective. Further, fromFIG. 5, it is seen that indiscriminate use of security buttons bynon-authorized persons will in the case of certain of the buttons, suchas 14SB1a and TSBla sound an alarm for surveillance purposes.

Assume now that the entering lobby passenger is familiar with the systemand with the specific code combination p-reviously assumed for theeighteenth landing. Assume then that immediately on entering theselected a car such person actuates security buttons ISBla and then13SB1a and 16SB1zz. As previously described, this results in FIG. 1 ofthe reference application, in actuation of switch 18Ca which, throughits 18C1a contacts permits operation of switch CKa. In FIG. 2 of thereference system, contacts CK4a closing are seen to complete a circuitthrough the closed WBIa contacts, car a selected, for actuation ofswitch LI. Contacts LIZ separating cause switch T to drop and closecontacts Tl for actuation of switch WBXa, through WBSa contacts.Contacts WBXZa closing then, in FIG. 2, although contacts SCC3a andSCO-2a are separated, cooperate with contacts CKoa, now closed due tothe recognized demand, to initiate dispatch of the a car from the lobby.

Assume now that just prior to entry of the authorized person, thepreviously assumed landing call had initiated dispatch of car a, itsSCOZiz contacts having closed. Dispatch is deferred due to SRa resetaction of occupancy actuated SCOla contacts. Registration of arecognized demand by the entering passenger causes CK contact action toagain set SRa switch for dispatch for service to Iboth the landing calland the recognized car security call. Failure to register the recognizedsecurity call would result in transfer of selection to car b anddetention of car a, as previously described.

In certain installations it may be desirable to operate without theoccupancy detection switches, such as in a modernization of an existingelevator. A person skilled in the art can readily apply the invention topermit only an unselected lobby car (parked with doors closed) torespond to landing calls, retaining the selected car for authorized uppassengers from the lobby, subject to the security car buttons. In asingle car installation it may be undesirable to handicap service toupper landing calls in event of lobby car occupancy by an unauthorizedperson. In such cases the variation shown in FIG. 6 and FIG. 7 permitsretention of the advantages of the security registration and control byinsuring that in the absence of registered recognized demand forced cartravel will be provided to the point of landing call. Surveillance bythe waiting passenger there is thus assured. As previously described,car a ini leaving the lobby without CKa operated would establish setstatus of SCXa. Contacts of SCXa void stopping for car calls andmaintain preventive torque against manual forced opening of doors untilarrival at the point of landing call, at which point XSSa contacts ofthe reference operate to reset SCXa. Conversely, departure from thelobby with a recognized security call would be accompanied by separatedstatus of CK7a contacts. Switch SCXa would not be set, normal dooroperation would be in effect and normal stop response to registered carpanel calls would be provided. It is readily understood the lastdescribed alternate arrangement can be used in conjunction with thatdescribed for switch SCO occupancy detection.

If separate security call buttons, such as those shown in FIG. 4, areemployed to establish the code required to permit a car passenger tocause the car to depart and if it is not desired to cause the car todepart for the desired Hoor after operation of the combination ofsecurity call buttons, the above described system may be modied topermit departure of a car after operation of the combination of securitycall buttons and then operation of the normal car call button for thedesired floor. Such modification has advantages for installation inexisting systems when it is not desired to modify the existing car callswitches and permits the use of a single code combination for all oors.Also, such modification makes available additional security call buttonsfor operating the alarm, thereby increasing the probability that anunauthorized person will operate the alarm.

Said modification may, for example, be accomplished by connecting the mClead of FIG. 4 to the positive line of FIG. 1, omitting the connectionbetween the mC leads of FIGS. 1 and 4, and interconnecting one of themtl-mj leads of FIG. 4 to the right hand contact of SCC4a in FIG. 1,thereby bridging the SCC4a contacts by the circuits in FIG. 4. If it isassumed that lead mj (FIG. 4) is connected to the right hand contact ofSCC4a, then operation of buttons 17SB1a and 12SB2a will by-pass contactsSCC4a and operation thereafter of one of the normal car call buttonsTCBa, ISCBa, etc. will cause the car to travel to the oor correspondingto the car call button operated. Any or all of the remaining switchesISSBla, 16SBla, etc. and 1SSB2a, 16SB2a, etc. in FIG. 4 may be connectedto the alarm SCBa (FIG. 5) in the same manner as switch 14SB1a, so thatoperation of any one of the remaining switches will cause operation ofthe alarm. l

It is also obvious to one skilled in the art that other known forms ofoccupancy detection may be applied, such as photoelectric, load mat orproximity devices. Extension of control by the security buttons to otherlandings of car position, such as a basement garage, rather than to thelobby only, is also readily accomplis-hed by one skilled in the art.Supplementary known means may be used for sounding the alarm such asoccupancy for an undue period with the car idle. Actuation of the alarmrelay may also cause, in a known manner, doors to close, restrainedagainst automatic or manual reopening. As these and other apparentlydifferent modilications of the invention can be made without departingfrom the scope thereof, it is intended that all matter contained in theprecedin-g description or shown on the accompanying drawings beinterpreted as illustrative only and not in a limiting sense.

It will be apparent from the foregoing that with one of the controlsystems of the invention, the use of the elevator cars by unauthorizedpersons for trips from the lobby or dispatching oor, or any otherselected floor, t0

another iloor, is prevented and that with another con- Atrol system ofthe invention, unauthorized persons are prevented from travelling fromthe selected oor to a floor other than one at which a landing call, asdistinguished from a car call, is registered. Furthermore, if buttons inthe car which are not correct buttons, are pressed, an alarm will begiven. However, normal, single button call registration is suliicient toprovide normal service `between floors other than the selected oor orfrom other oors to the selected floor.

Having thus described my invention with particular reference to thepreferred form thereof and having shown and described certainmodifications, it will be obvious to those skilled in the art to whichthe invention pertains, after understanding my invention, that variouschanges and modifications may be made therein without departing from thespirit and scope of my invention, as defined by the claims appendedthereto.

What is claimed is:

1. An elevator system comprising an elevator car serving a plurality oflandings, means for controlling the travel of said car between landingscomprising a plurality of means in said car normally each manuallyoperable 'by a passenger in said car to select a landing to which thecar is to travel, control means normally responsive to the operation ofeach one of said plurality of means to cause said car to travel to eachlanding selected by a passenger, and security means comprising means forcausing said control means to be responsive to the operation of saidplurality of means in predetermined combinations, each combinationcorresponding to a selected landing, said security means furthercomprising means for preventing the normal response of said controlmeans to each one of said plurality of means while permitting saidcontrol means to be responsive to the operation of said plurality ofmeans in said predetermined combinations.

2. An elevator system, comprising an elevator car serving -a pluralityof landings, means for controlling the travel of said car betweenlandings comprising a plurality of means in said car each normallyoperable by a passenger in said car to select a landing to which the caris to travel, control means normally responsive to the operation of eachof said plurality of means to cause said car to travel to each landingselected by a passenger, `and security means comprising means operableby a passenger in said car in predetermined combinations with saidplurality of means for operating said control means, each combinationcorresponding to a selected landing, said securing means furthercomprising means for preventing the normal response of said controlmeans to each of said plurality of means while permitting operation ofsaid control means in response to operation of said means operable by apassenger in said car in predetermined combinations.

3. An elevator system comprising an elevator car serving a plurality oflandings, car call registering means on said car, landing callregistering means at said landings, control means responsive to landingcalls registered by said landing call registering means and to car callsregistered in a first predetermined manner by said car call registeringmeans for causing said car to serve said registered calls, and securitymeans comprising means causing said control means to cause said car toserve car calls which are registered in a second predetermined manner,said securing means further comprising means for preventing response ofsaid control means to car calls registered in said first predeterminedmanner while permitting said control means to cause said car to servecar calls which are registered in -a second predetermined manner.

4. In an elevator dispatching and control system for an elevator carserving a plurality of landings from a dispatching landing and havingmeans for normally causing said car to travel from said dispatchinglanding to said plurality of landings to provide service to demandsregistered by landing call. registering means at said plurality oflandings and by car call registering means on said car, security controlmeans operable to modify the travel of said car from said dispatchinglanding, said security control means comprising a plurality of passengeroperable means on said car operable in predetermined combinations, eachcombination corresponding to a diiferent predetermined landing otherthan the dispatching landing, and means connected to said plurality ofmeans and controlled thereby for causing said car to travel from saiddispatching landing to the landing corresponding to the combinationoperated, said security control means further comprising means forpreventing travel of said car from said dispatching landing with normaloperation of said car-call registering means while permitting operationof said plurality of passenger operable means and response of said meansconnected to said plurality of means.

S. In a system according to claim 4 wherein said car comprises doors anddoor closing means for applying a normal closing force thereto, saidsecurity control means further comprising passenger controlled meansoperable by a passenger in said car and means controlled by saidpassenger controlled means and said landing call registering means forcausing said car to travel to a landing at which a demand is registeredand for causing said door closing means to apply an above normal doorclosing force to said doors in the absence of the operation of saidplurality of means in one of said combinations.

6. In an elevator dispatching and control system for a plurality ofelevator cars serving a plurality of landings from adispatching landingand having means for normally causing cars to travel from saiddispatching landing to said plurality of landings to provide service todemands registered by landing call registering means at said pluralityof landings and by car call registering means in said cars, securitycontrol means operable to modify the travel of said cars from saiddispatching landing, said security control means comprising a pluralityof passenger operable switches in each car operable in predeterminedcombinations, each combination corresponding to a differentpredetermined landing other than the dispatching landing, and meansconnected to said switches and controlled thereby for causing the carsin which they are operated to travel from said dispatching landing tothe landing corresponding to the combination operated, said securingmeans further comprising means for preventing travel of a car from saiddispatching landing with normal operation of said car-call registeringmeans while permitting operation of said plurality of passenger operableswitches and response of said means connected to said switches.

7. In an elevator system according to claim 6, wherein said car callregistering means comprises a plurality of push buttons, and meansfurther comprising means interconnecting said plurality of switches andsaid push buttons.

8. In an elevator dispatching and control system for a plurality ofelevator cars serving a plurality of landings from a dispatching landingand having dispatching means for normally dispatching cars from saiddispatching landing to said plurality of landings under control ofdemands registered by landing call registering means at said pluralityof landings and by car call registering means in said cars, securitycontrol means operable to modify the operation of said dispatchingmeans, said security control means comprising a plurality of passengeroperable switches in each car operable in predetermined combinations,certain ones of said combinations each corresponding to a differentpredetermined landing other than the dispatching landing, saiddispatching means being connected to said switches and controlledthereby for causing the cars in which they are operated to be dispatchedfrom said dispatching landing to the landing corresponding to thecombination operated, said security control means further comprisingmeans for preventing dispatching of a car from said dispatching landingwith normal operation of said car call registering means whilepermitting operation of said plurality of passenger operable switchesand response of said dispatching means thereto, :and means for providingnormal operation of said cars in response to operation of said landingcall registering means and in response to operation of said car callregistering means when the car in which the latter means is operated isat a landing other than said dispatching landing.

9. An elevator system comprising an elevator car serving a plurality oflandings, means for controlling the travel of said car between saidlandings comprising at least three switches each manually operable by apassenger in said car without causing operation of another one of saidswitches, control means operable by a combination of a plurality ofoperated predetermined ones of said switches for causing said car totravel from one said landing to another said landing, said control meansbeing unresponsive to operation of a number of said predetermined onesof said switches less than said plurality thereof.

10. An elevator system as set forth in claim 9, wherein said controlmeans is responsive to a plurality of predetermined combinations ofoperated ones of said switches, each said combination causing travel ofsaid car to a different landing, and is unresponsive to operation ofsaid switches in other than said predetermined combinations.

11. An elevator system as set forth in claim 10 in which said switchesare in a landing selecting group and further comprising alarm meansoperable by at least one of said switches other than a switch in saidpredetermined combinations thereof.

12. An elevator system as set forth in claim 3 further comprising alarmmeans responsive to the registration of car calls in other than saidsecond predetermined manner.

13. In an elevator system according to claim 6, said security controlmeans further comprising means in said cars operable by a passengertherein and means controlled by said last-mentioned means and saidswitches for causing an unoccupied car to travel from the dispatchinglanding to a landing at which a demand is registered upon failure of apassenger in a car to operate said switches in one of said combinations.

References Cited UNITED STATES PATENTS 1,893,332 1/1933 Lind 187--432,517,619 8/1950 Ainley 340-63 2,964,733 12/1960 Raju 340-63 JOHN W.CALDWELL, Primary Examiner.

NE1L C. READ, Examiner.

A. H. WARING, Assistant Examiner.

